量子密信-Openclaw对接

帮助中国电信同人及客户实现通过量子密信调用 OpenClaw 机器人。支持文本、图片、附件及状态栏反馈。

This skill appears to implement the advertised Quantum Messenger <-> OpenClaw bridge, but it has concrete implementation risks you should address before deploying: - Command injection risk: the code builds a shell command with unescaped JSON (exec). Replace exec with a safe invocation (child_process.spawn with argument array) or otherwise sanitize input to avoid arbitrary command execution. - Arbitrary-file upload / exfiltration: the listener will upload any local file path returned by the AI (IMAGE:/FILE:) to an external host (imtwo.zdxlz.com). Restrict what paths are allowed, run the service with least filesystem privileges, and audit what files might be accessible. - Plain HTTP + key-in-query: the upload/send endpoints use http and include QUANTUM_KEY in the URL query string, which exposes credentials in transit and in logs. Use HTTPS endpoints and send auth in headers where possible. Verify whether imtwo.zdxlz.com is an official/trusted Quantum Messenger endpoint; if not, do not send sensitive data. - Network trust and isolation: run this service in a locked-down container or VM with minimal privileges and limited outbound network access to only the known Quantum endpoints. Monitor logs for unexpected uploads. - Additional checks: confirm the ownership/trustworthiness of the imtwo.zdxlz.com host; audit and pin the OpenClaw CLI binary you run; rotate QUANTUM_KEY after testing. If you cannot confirm the upstream endpoint and cannot harden command execution and file-access logic, treat this skill as risky and avoid deploying it on systems that hold sensitive data.

Type: OpenClaw Skill Name: quantum-messenger Version: 1.0.2 The skill contains a significant command injection vulnerability in `scripts/listener.mjs` where user-provided content is passed to `child_process.exec` via the OpenClaw CLI. Furthermore, the logic in `listener.mjs` that parses AI responses for `IMAGE:` or `FILE:` prefixes and automatically uploads the referenced paths to an external endpoint (`imtwo.zdxlz.com`) creates a high risk of arbitrary file exfiltration if the AI is manipulated. While these appear to be architectural flaws rather than intentional malware, the combination of remote command execution risk and file access makes the bundle unsafe for production without sanitization.